What it means
We couldn’t authenticate the request. Either there’s noAuthorization
header, the bearer token we saw doesn’t match anything we issued, it’s
expired, or it’s been revoked.
Common causes & fixes
Distinguishing “expired” vs “revoked”
We don’t expose this in thedetail for security reasons (you shouldn’t be
able to probe which case you’re in to enumerate users). Treat them the same:
- Try a refresh. If it succeeds, you had a stale access token — store the new pair and retry the original request.
- If the refresh itself returns
invalid_grant, the user has either disconnected or your refresh token has expired (90-day TTL). In either case, you need to send the user through the authorize flow again.

